The Rhysida ransomware gang has listed Broadstreet HEOR on its leak site. Broadstreet HEOR is a health economics and outcomes research consultancy based in Vancouver, Canada. The gang says it stole US Medicaid patient data, client database credentials and confidential pharmaceutical documents. For now this is only the gang's claim. Two threat-tracking sites, QPulse and DeXpose, reported the leak-site post on October 28, 2026. Broadstreet HEOR has not commented publicly. No breach notification has been posted to the US Department of Health and Human Services, any state attorney general or Canadian privacy regulators. No established security news outlet has independently checked the data. Readers should treat every figure below as an unverified claim until the company or a regulator confirms it.
What Happened
On October 28, 2026, Rhysida posted Broadstreet HEOR (broadstreetheor.com) as a victim. DeXpose published the gang's statement in full. In it, Rhysida describes Broadstreet as a consultancy that runs health economics and real-world evidence studies for drug companies. It names Pfizer, Bayer, Boehringer Ingelheim, Takeda, Madrigal, Alexion/AstraZeneca, Bristol-Myers Squibb, Sarepta, Taysha and Biohaven. QPulse reports that the incident was discovered the same day it was posted. It rates the incident 95 out of 100 for severity, but that score is QPulse's own automated rating, not a finding from an investigation.
Nobody has published anything about how or when the attackers got in, whether files were encrypted, or what ransom was demanded. So far, everything comes from the gang's own post and two sites that repeated it.
The headline number needs careful reading. QPulse's headline says "11.3 million Medicaid patient records." The gang's own wording, as quoted by DeXpose, is "11.3M rows." A row in a claims or research database is often a single prescription fill, diagnosis code or payment, not a single person. One patient can take up dozens or hundreds of rows. So the number of people affected could be much lower than 11.3 million. Only a forensic review or a regulator filing will settle it.
What Was Taken
According to the gang's post, as reproduced by DeXpose and summarised by QPulse, the stolen data includes:
- US Medicaid patient data: 11.3 million rows with dates of birth, race, diagnoses, National Drug Codes (NDC) and payment details.
- Electronic health record data: tables the gang says come from Veradigm/Allscripts.
- Licensed commercial claims data: extracts the gang says come from IBM MarketScan and Optum Clinformatics. These datasets are normally licensed to researchers in de-identified form under data use agreements. If the claim is true, the main problem may be breach of those licence terms rather than exposure of named patients. That depends on what fields the files actually contain.
- A production database called "Alexiondb": a PostgreSQL schema plus claims rows.
- Live client credentials: SQL Server login details for a production database named "irsf-nhs-prod-db", which the gang says belongs to client Taysha Gene Therapies and is reachable on a public IP address.
- Confidential drug company material: unpublished Boehringer Ingelheim slides, a Takeda manuscript, Bayer cost-effectiveness models, Madrigal reports, and emails involving Pfizer and the US Department of Veterans Affairs.
- Staff personal documents.
The gang has not said how much data it holds in total, and no sample files have been checked independently. Rhysida has inflated or repackaged data before, but it has also leaked real data in the past. In the recent Anne Arundel County case, the county confirmed the theft after the gang made its claim.
Why It Matters
The data passes through many hands. Firms like Broadstreet sit between drug makers, data brokers and public health programs. One break-in at a consultancy can expose data owned by a dozen sponsors and several licensed data vendors at once. Their customers may not even know Broadstreet holds a copy. A Canadian firm holding US Medicaid data also raises questions about which country's rules apply and who has to send notifications: Broadstreet itself, the state Medicaid agencies, the data licensors, or the sponsoring drug companies.
The credential claim is the most urgent part. If the Taysha Gene Therapies SQL Server login details are real and still work, anyone who downloads the leak can use them, not just Rhysida. That creates a second, separate exposure at a company that was not the original victim.
Rhysida's claims often turn out to be real. The Record reports that Anne Arundel County, Maryland, confirmed in October that an attacker had copied files from its systems. Rhysida had already claimed that attack and demanded $2 million for 2.6TB of data. Cybernews reports the gang is now selling that data for 25 BTC. According to The Record, Rhysida's past victims include Kuwait's Finance Ministry, the cities of Seattle and Columbus, Ohio, the Maryland Department of Transportation, and a recent extortion attempt against the Berlin city government. Proven Data counted 303 victims on Rhysida's leak site as of October 26, 2026. It says about 17% of them are in healthcare and 15% in professional services. Broadstreet is in both groups.
Healthcare breach numbers often change after the first report. Bank Info Security reported that cardiac monitoring firm iRhythm first notified about 370,000 people of a June breach. It later disclosed that 8.2 million individuals were affected. The HIPAA Journal reports that EHR vendor zHealth took about three months to confirm that 118,563 people were affected after the Kazu gang claimed the attack. Expect the Broadstreet numbers to change too, in either direction.
The Attack Technique
Nobody has said how Rhysida got into Broadstreet's network. Here is what is known about the group's usual methods.
Proven Data's profile of the group says Rhysida has been active since May 2023. It is linked to the same operators previously behind Vice Society ransomware, a cluster also tracked as Vanilla Tempest and GOLD VICTOR. The group's usual approach is double extortion: it steals data, encrypts systems, then auctions the data on its Tor leak site. Proven Data lists these common ways in:
- VPN accounts that do not require multi-factor authentication (MFA)
- Fake installers signed with code-signing certificates
- Lures that trick users into running commands themselves
The encryptor targets Windows, Linux and VMware ESXi. It adds the extension .rhysida to encrypted files and leaves a ransom note called CriticalBreachDetected.pdf. Proven Data says a free decryptor works on early Windows versions but not on all of them.
Some details in the gang's post match a pattern of poor database security. These include a production SQL Server that was reportedly reachable on a public IP address, and credentials that were reportedly stored where the attackers could find them. Neither has been confirmed.
What Organizations Should Do
- Drug makers and research sponsors that work with Broadstreet HEOR: ask the firm now exactly which of your datasets, documents and system credentials it held. Don't wait for a formal notification. Check your own contracts for breach-notification deadlines.
- Rotate any credentials shared with outside research partners. Taysha Gene Therapies in particular should treat the irsf-nhs-prod-db credentials as compromised. It should reset them, review login records for access from unfamiliar IP addresses, and take the database off the public internet.
- Licensed data vendors and Medicaid data custodians: check which licensees hold MarketScan, Clinformatics or state Medicaid extracts. Confirm that their data use agreements require MFA, encryption at rest and secure deletion.
- Close the doors Rhysida usually uses. Require MFA on every VPN and remote access account. Block unsigned or newly seen installers from running. Alert on unusual large outbound data transfers, especially from database servers.
- Keep production databases off the internet. Put SQL Server and PostgreSQL behind a VPN or private network connection. Keep connection strings out of shared drives, scripts and email.
- Prepare for the leak. If Rhysida publishes or sells the data, watch for phishing aimed at your staff that uses real project names, sponsor names or document titles taken from the stolen files.
Sources: Rhysida Ransomware Group Claims Attack on Broadstreet HEOR, Exposin... | Baltimore suburb confirms August data breach after ransomware claim... | Heart Monitor Firm Notifying at Least 370,000 Patients of Hack | xHealth Data Breach Affects 118,000 Individuals | Rhysida Ransomware Strikes Broadstreet HEOR in Canada - DeXpose | Rhysida Ransomware: Attack Chain, IOCs, and Recovery Options | Maryland government data stolen by ransomware gang put up for sale... | Rhysida Ransomware Group Exfiltrates 2.6 TB of Data from Anne Arund...